ClawHub
Back to skill

Security audit

analyzing-youtube-competitor-channel-strategy

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward YouTube competitor-analysis helper that uses Apify, with credential and third-party data-sharing risks users should handle carefully.

Install only if you are comfortable sending YouTube channel identifiers, search terms, and scraper inputs to Apify. Keep APIFY_TOKEN in an environment variable or secrets manager, avoid pasting token-bearing URLs into logs or chats, prefer the MCP or a helper that does not expose tokens in URLs, and do not submit confidential strategy data as search terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": "https://www.youtube.com/@[COMPETITOR_CHANNEL]", "maxItems": 100}'
Confidence
92% confidence
Finding
This command sends user-supplied search terms and an authentication token to an external API endpoint, creating both data egress and credential-exposure risk. Passing the token in the URL is especially risky because URLs are commonly captured in shell history, logs, proxies, and monitoring systems.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
90% confidence
Finding
The dataset fetch step retrieves results from an external service using a URL that again includes APIFY_TOKEN in the query string. This repeats the credential leakage risk and also expands exposure by pulling potentially sensitive analytical output over a third-party channel.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
90% confidence
Finding
The dataset fetch step retrieves results from an external service using a URL that again includes APIFY_TOKEN in the query string. This repeats the credential leakage risk and also expands exposure by pulling potentially sensitive analytical output over a third-party channel.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill requires an APIFY_TOKEN but does not include any guidance on secure credential handling, storage, redaction, or avoiding exposure in logs and shared commands. While common in integration docs, omission of these warnings can lead users to paste secrets into insecure places or leak them during troubleshooting.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs sending competitor channel URLs, handles, keywords, and query data to Apify's external service without a clear notice that this information leaves the local environment. This creates a privacy and governance risk, especially for sensitive competitive-intelligence workflows or internal research terms.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.